Commit 1509cb00 removed this useful functionality, because it was causing hard
to debug crashes. This, in a large part, was due to plugins creating GsApps
themselves, rather than calling into the plugin.
To prevent this happening again actually hide the gs_app_new() functionality
from the plugins, and provide two helpers for the cases where this doesn't need
to go via the plugin loader; which are download status reporting and wildcards.

The scribus.desktop file has a hardcoded `X-AppInstall-Package=scribus` which
gets processed, merged, and added to the flatpak *AppStream* metadata.
This causes bad things to happen when the appstream helper code helpfully adds
'scribus' as a bundle source, but libflatpak complains it's not a valid ref.

Use fine grained locking around PkClient / PkTask methods so that we
(a) only take the lock for as short period of time as needed and
(b) avoid deadlocks when one locked function calls into another.
This fixes the self tests to pass again (to not deadlock) after
commit d4274572.

For reasons unknown commit f82744a4 broke loading the
software-installed-symbolic icon when it moved it from hicolor/scalable/
to hicolor/symbolic/. Move it back to where it was before to fix this.
Fixes: #596